Recent vulnerabilities and exploits

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property....

Phpmailer Project Phpmailer Wordpress Wordpress Joomla Joomla\\!5 EDB exploits available1 Metasploit module available85 Github repositories available2 Articles available

An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base...

Phpmailer Project Phpmailer1 EDB exploit available84 Github repositories available

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail...

Phpmailer Project Phpmailer Wordpress Wordpress Joomla Joomla\\!2 EDB exploits available1 Metasploit module available86 Github repositories available2 Articles available

The TETRA TA61 identity encryption function internally uses a 64-bit value derived exclusively from the SCK (Class 2 networks) or CCK (Class 3 networks). The structure of TA61 allows for efficient recovery of this 64-bit value, allowing an adversary to encrypt or decrypt...

2 Articles available

Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)...

Google Chrome Debian Debian Linux 11.0 Debian Debian Linux 12.0

Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload injected into the VIEWSTATE...

Grupposcai Realgimm 1.1.371 Github repository available

The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks...

Limit Login Attempts Project Limit Login Attempts

H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS....

H3c Ssl Vpn7 Github repositories available

QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data....

Qsan Xn8024r Firmware 3.1.5 Qsan Xn8008t Firmware 3.3.21 Github repository available

Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header....

Dolibarr Dolibarr Erp\\/crm 11.0.0

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook